CVE-2026-13001 is an improper input validation vulnerability in the Podlove Podcast Publisher plugin for WordPress, affecting all versions up to and including 4.5.1. The issue arises from missing file type validation in the 'podlove_handle_cache_files' function, which permits unauthenticated attackers to upload arbitrary files to the affected server. This can lead to remote code execution if malicious files are executed on the server. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

An unauthenticated attacker can upload arbitrary files to the server hosting the vulnerable Podlove Podcast Publisher plugin, which may lead to remote code execution. This compromises confidentiality, integrity, and availability of the affected system, allowing full control by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict access to the plugin and monitor for suspicious file uploads. Consider disabling or removing the plugin if possible to mitigate risk.